CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2024-56156 – Halo Vulnerable to Stored XSS and RCE via File Upload Bypass
https://notcve.org/view.php?id=CVE-2024-56156
25 Apr 2025 — Halo is an open source website building tool. Prior to version 2.20.13, a vulnerability in Halo allows attackers to bypass file type validation controls. This bypass enables the upload of malicious files including executables and HTML files, which can lead to stored cross-site scripting attacks and potential remote code execution under certain circumstances. This issue has been patched in version 2.20.13. • https://github.com/halo-dev/halo/security/advisories/GHSA-99mc-ch53-pqh9 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43793 – Halo's editor has a stored XSS vulnerability
https://notcve.org/view.php?id=CVE-2024-43793
11 Sep 2024 — Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. This vulnerability is fixed in 2.19.0. • https://github.com/halo-dev/halo/security/advisories/GHSA-28x9-hppj-m537 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-43792 – Halo's editor has a stored Cross-Site Scripting vulnerability
https://notcve.org/view.php?id=CVE-2024-43792
02 Sep 2024 — Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.17.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a Cross-Site Scripting (XSS) attack. Users are advised to upgrade to version 2.17.0+. There are no known workarounds for this vulnerability. • https://github.com/halo-dev/halo/security/advisories/GHSA-x3rj-3x75-vw4g • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-27164
https://notcve.org/view.php?id=CVE-2023-27164
10 Mar 2023 — An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. • http://halo.com • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-22125 – Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Tag
https://notcve.org/view.php?id=CVE-2022-22125
13 Jan 2022 — In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victim’s server. En Halo, versiones v1.0.0 a v1.4.17 (la más reciente) son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado en la etiqueta article. Un atacante autenticado puede inyectar código javascript arbitrario que será ejecutado en el servidor de la víctima • https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L500 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-22124 – Halo CMS - Stored Cross-Site Scripting (XSS) in Profile Image
https://notcve.org/view.php?id=CVE-2022-22124
13 Jan 2022 — In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victim’s browser. En Halo, versiones v1.0.0 a v1.4.17 (la más reciente) son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado en la imagen del perfil. Un atacante autenticado puede subir un archivo SVG cuidadosamente diseñado que desencadenará la ejecución... • https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/handler/file/FileHandler.java#L30 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2022-22123 – Halo CMS - Stored Cross-Site Scripting (XSS) in Article's Title
https://notcve.org/view.php?id=CVE-2022-22123
13 Jan 2022 — In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victim’s server. En Halo, versiones v1.0.0 a v1.4.17 (la más reciente) son vulnerables a un ataque de tipo Cross-Site Scripting (XSS) Almacenado en el título del artículo. Un atacante autenticado puede inyectar código javascript arbitrario que será ejecutado en el servidor de la víctima • https://github.com/halo-dev/halo/blob/v1.4.17/src/main/java/run/halo/app/service/impl/PostServiceImpl.java#L391 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2020-23079
https://notcve.org/view.php?id=CVE-2020-23079
12 Jul 2021 — SSRF vulnerability in Halo <=1.3.2 exists in the SMTP configuration, which can detect the server intranet. Una vulnerabilidad de tipo SSRF en Halo versiones anteriores a 1.3.2 incluyéndola, se presenta en la configuración SMTP, que puede detectar la intranet del servidor • https://github.com/halo-dev/halo/issues/806 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-21345
https://notcve.org/view.php?id=CVE-2020-21345
20 May 2021 — Cross Site Scripting (XSS) vulnerability in Halo 1.1.3 via post publish components in the manage panel, which lets a remote malicious user execute arbitrary code. Una vulnerabilidad de tipo Cross Site Scripting (XSS) en Halo versión 1.1.3, por medio de un componente post publish en el panel de administración, que permite a un usuario malicioso remoto ejecutar código arbitrario • https://github.com/halo-dev/halo/issues/336 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 0CVE-2020-21527
https://notcve.org/view.php?id=CVE-2020-21527
30 Sep 2020 — There is an Arbitrary file deletion vulnerability in halo v1.1.3. A backup function in the background allows a user, when deleting their backup files, to delete any files on the system through directory traversal. Se presenta una vulnerabilidad de eliminación de archivos Arbitraria en halo versión v1.1.3. Una función de backup en segundo plano permite al usuario, al eliminar sus archivos de backup, eliminar cualquier archivo del sistema por medio de un salto de directorio • https://github.com/halo-dev/halo/issues/422 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •